CVE-2026-57858 Cal.com CVE debrief

Who should care

Defenders responsible for Cal.com Cal.diy instances, especially those with public booking pages, should assess exposure and verify the effectiveness of current input validation and sanitization measures.

Why it matters

CVE-2026-57858 is a stored cross-site scripting vulnerability in Cal.com Cal.diy that allows authenticated event owners to inject arbitrary JavaScript, enabling session cookie theft, forged authenticated requests, and wormable propagation. Defenders should prioritize verifying exposure and assessing the effectiveness of current input validation and sanitization measures.

• Session cookie theft through injected JavaScript
• Forged authenticated requests via injected JavaScript
• Wormable propagation through chaining with CSRF-able endpoints
• Verification of input validation and sanitization measures for the BookingPageTagManager component

Technical summary

The BookingPageTagManager component in Cal.com Cal.diy versions 2.1.1 through 6.2.0 is vulnerable to stored cross-site scripting. Authenticated event owners can inject arbitrary JavaScript by supplying a malicious analytics tracking ID without sanitization, potentially leading to session cookie theft, forged authenticated requests, and wormable propagation through chaining with CSRF-able endpoints. Defenders should prioritize verifying exposure of Cal.com Cal.diy instances, especially those with public booking pages, and assess the effectiveness of current input validation and sanitization measures to mitigate potential risks.

Defensive priority

Defenders should prioritize verifying exposure of Cal.com Cal.diy instances, especially those with public booking pages, and assess the effectiveness of current input validation and sanitization measures.

Recommended defensive actions

• Verify exposure of Cal.com Cal.diy instances, especially those with public booking pages
• Assess the effectiveness of current input validation and sanitization measures for the BookingPageTagManager component
• Implement additional monitoring and logging to detect potential exploitation attempts
• Review and update incident response plans to address potential session cookie theft and forged authenticated requests
• Apply vendor patches or updates as available and feasible
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but the scope of affected versions and remediation steps require verification from official sources. Cal.com Cal.diy versions 2.1.1 through 6.2.0 are reportedly affected, but specific configurations and environmental factors may influence exposure. Defenders should verify the effectiveness of current input validation and sanitization measures for the BookingPageTagManager component, review system logs for suspicious activity, and assess the potential impact on their

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.